Detection of environment variable tampering (HISTFILE, HISTCONTROL, HISTFILESIZE) and absence of expected bash history writes. Correlation of unset or zeroed history variables with active shell sessions is indicative of adversarial evasion.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | auditd:SYSCALL | execve calls modifying HISTFILE or HISTCONTROL via unset/export |
| Process Creation (DC0032) | linux:osquery | processes modifying environment variables related to history logging |
| Field | Description |
|---|---|
| MonitoredUsers | Specific accounts or groups where history logging must always be enforced. |
| TimeWindow | Correlation period to detect unset/export of history variables during active shells. |
Detection of bash/zsh history suppression via HISTFILE/HISTCONTROL manipulation and absence of ~/.bash_history updates. Observing environment variable changes tied to terminal processes is a strong indicator.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | macos:unifiedlog | Set or unset HIST* variables in shell environment |
| Field | Description |
|---|---|
| ShellProfiles | Different shells (bash, zsh, fish) may require customized monitoring for history tampering. |
Detection of PowerShell history suppression using Set-PSReadLineOption with SaveNothing or altered HistorySavePath. Correlating these options with PowerShell usage highlights adversarial evasion attempts.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | WinEventLog:PowerShell | EventCode=4103 |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Field | Description |
|---|---|
| AllowedPaths | List of acceptable PowerShell history save paths for baseline comparison. |
Detection of unset HISTFILE or modified history variables in ESXi shell sessions. Correlation of suspicious shell sessions with no recorded commands despite active usage.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | esxi:shell | unset HISTFILE or HISTFILESIZE modifications |
| Field | Description |
|---|---|
| AdminSessions | Differentiate root/admin shell sessions from adversarial misuse of ESXi shell. |
Detection of CLI commands that disable history logging such as 'no logging'. Anomalous lack of new commands in session logs while activity persists is a strong signal.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | networkdevice:cli | Commands like 'no logging' or equivalents that disable session history |
| Field | Description |
|---|---|
| DeviceVendors | Command syntax differs across Cisco, Juniper, Fortinet, etc., requiring vendor-aware tuning. |